IOMMU and Kernel-DMA Protection

NTDEV
1

Good afternoon fellows,

Kernel-DMA Protection places peripherals in dedicated IOMMUs. A multifunction ASIC uses a WDFCOMMONBUFFER as a recipient for MemWr; DRIVER_VERIFIER_DMA_VIOLATION bugcheck is raised.

  1. Are the IOMMU domains prepared by the OS identical for both functions? DmaOperations->GetDmaDomain(dmaAdapter) returns different handles, undocumented.

  2. WdfCommonBufferGetAlignedLogicalAddress() returns the HPA. If the domains are not identical, then one approach is specifying DmaRemappingCompatible in the .inf and have both DOs in the same IOMMU domain:

    allocConfig.LogicalAllocatorType = IommuDmaLogicalAllocatorBuddy;
    allocConfig.BuddyAllocatorConfig.AddressWidth = 63;
    IommuInterface.V2.CreateDomainEx(DomainTypeTranslate,
                                     zero,
                                     &allocConfig,
                                     NULL,
                                     &singleDomain);
    for (i = 0; i < 2; i ++)
    {
        IommuInterface.V2.CreateDevice(pdo[i], NULL, &dmaDevice[i]);
        IommuInterface.V2.AttachDeviceEx(singleDomain, dmaDevice[i]);
    }

    mapConfig.MapType = MapPhysicalAddressTypeMdl;
    mapConfig.Mdl.Mdl = Mdl;
    status = IommuInterface.V2.MapLogicalRangeEx(singleDomain, IOMMU_ACCESS_READ | IOMMU_ACCESS_WRITE, &mapConfig, NULL, NULL, NULL, &iova);

Please confirm or dismiss; the plan is to use IOVA as a destination for TLPs generated by both PCIe endpoints.

Thank you.
Călin